DRAWINGS TO BE DELETED FROM THE APPLICATION 
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Client - PG conversation 
35.307723 cUent.2894 > PG.80: S 649812829:649812829(0) win 8192 id 37968 

SCk 649812830 

35.394877 clienL2894 > PG.80: . ack 1 win 8576 id 37989 
35.402592 client.2894 > PG.80: P 1:405(404) ack 1 win 8576 id 37991 
35.404046 PG.80 > client.2894: P 1:160(159) ack 405 win 32736 id 22902 
35.404327 PG.80 > client.2894: F 160: 160(0) ack 405 win 32736 id 22903 
35.499080 client.2894 > PG.80: . ack 161 win 8417 id 38023 \ 
35.598546 client.2894 > PG.80: F 405:405(0) ack 161 win 8576 id 38049 
35.598617 PG.80 > client.2894: . ack 406 win 32735 id 22925 
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35.307723 client.2894 > PG.80: S 649812829:649812829(0) win 8192 id 37968 
<mss 536> 
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EWS duplicates client open 

35.307864 client.2894 > IG.80: S 649812829:649812829(0) win 8192 id 37968 
<mss 536> (ews) 

35.307807 PG.80 > client.2894: S 2103996938:2103996938(0) ack 649812830 
win 32736 id 22893 <mss 536> 

Invisible Ghost responds to open 

35.308005 IG.80 > client.2894: S 1396028487:1396028487(0) ack 649812830 
win 32736 id 44202 <mss 536> 
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35.394877 client.2894 > PG.80: . ack 1 win 8576 id 37989 

EWS duplicates client first ack, adjusting sequence numbers 
35.394940 client.2894 > IG.80: . ack I win 8576 id 3750 (ews) 

35.402592 client.2894 > PG.80: P 1:405(404) ack 1 win 8576 id 37991 

EWS duplicates client request 

35.402723 client.2894 > IG.80: P 1:405(404) ack 1 win 8576 id 37991 (ews) 
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Invisible Ghost responds with 196 bytes 

35.404068 IG.80 > ciient.2894: P 1:197(196) ack 405 win 32736 id 44209 
Production Ghost with 159 bytes 

35.404046 PG.80 > client.2894: P 1:160(159) ack 405 win 32736 id 22902 
PG closes connection 

35.404327 PG.80 > client.2894: F 160:160(0) ack 405 win 32736 id 22903 
IG closes connection 

35.404457 IG.80 > client.2894: F 197:197(0) ack 405 win 32736 id 44210 




\ 




V 

Client acknowledges data & FIN f\ 
35.499080 client.2894 > PG.80: . ack 161 win 8417 id 38023 ^ 



EWS ack's data (rounding to packet boundary) 

35.499146 client.2894 > IG.80: . ack 197 win 8381 id 3776 (ews) 



EWS ack's FIN (blowing window open for drain) 
35.540786 client.2894 > IG.80: . ack 198 win 65533 id 3778 (ews) 
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35.598546 client.2894 > PG.80: F 405:405(0) ack 161 win 8576 id 38049 
35.598604 client.2894 > IG.80: F 405:405(0) ack 198 win 8576 id 38049 (ews) 
35.598617 PG.80 > client.2894: . ack 406 win 32735 id 22925 
35.598754 IG.80 > client.2894: . ack 406 win 32735 id 44216 
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IKmp sxa\ Wed Jim 12 04:44: 14 2000 J| 

Id (38. 163.66.2: 1283) header* (request I)] 

^50aWV382b7678A^Jcokin»rLcomftrti9Wli<aU.gif HTTP/ 1.0 

Accepi-Emwling: gitp, deflate 

Uicr-Agent: MarillaM.O (compatible; MSIE 4.01: Windows 951 
Host: oimg.Bkomaitech.nel 

lW(3 ™M'i°^!j e:,der,(,)l0,ld - b y to: "WltoUy^a: I733J 
Hi [ rl l .0 200 OK 

Dtrte: Fri. 12 Nw (999 01:57:01 GMT 

Server: Apudie/I.3.4 (Unix) 

Lajt-McxliHed: Men. 09 Aug 1999 22:03:59 GMT 

ETng: "u9i:7|.6c7.37ar504r 

Accepl-Runges: byicl 

Cuuenl-Length: 1735 

Owiictii-Type: imuge/gtf 

Connection: dote 

tig (38 113. 123.201 :M) headers (l)lotaLbYtes: 1903 bcdy.bytes: 16561 
HTTP/ 1 .0 200 OK 

Dale: Wed. 12 Jun 2000 02: 15: 1 4 GMT 

Server ApcheM.3.4 (Unix) 

UM-Modiried: Wed. 1 1 Aug 1999 2002:14 GMT 

ETag: "7a939-678-37bld6c6- 

Accept- Ranges: bytes 

Cuiicm. Length: 1656 

Content-Type: image/gif 

G»mectim: clrue 
|msg| Differing response lengths 
Ilcrnp aid ) | 
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